Author: Corey Neskey, CISSP | | https://github.com/cneskey | https://linkedin.com/in/cneskey | https://github.com/cneskey/unsuR | @cneskey

Assessment Methodology

Col1

Methodology Criteria

A risk analysis should meet local, city, state, federal, and international compliance criteria and yield a corresponding risk assessment report. The criteria and objective of this analysis is as follows:

  1. To create a list of threats that the entity may become exposed to as a result of the changes presented in discussion with stakeholders.
  2. To communicate the estimated probability and impact of such threats.
  3. To create a list of controls/mitigation strategies that may reduce the probability, impact or uncertainty of the listed threats.
  4. To communicate the measure of how much the probability, impact or uncertainty of the listed threats is modified by the controls/mitigation strategies considered.
  5. To communicate the benefit of controls under consideration and costs associated with them.

Methodology Standardization & Interoperability

The taxonomy chosen is based on Open Group’s Factor Analysis of Information Risk (FAIR) standard, an open and independent information risk analysis methodology. This ensures transparency, continuity, and interoperability with other major standards.

The Open Group is an industry consortium that facilitates business objectives by developing open, vendor-neutral technology standards and certifications.The Open Group published two Open FAIR standards that form the risk taxonomy followed:

The FAIR Institute maintains publicly available documentation, resources, community events and other modes of promotion, training, and collaboration.

Deviations from Standard

The methodology used for this assessment deviates from published standards where those standards deviate from scientifically rigorous literature that meets the following criteria:

  • Academic Journal (not trade journals),
  • Peer-reviewed,
  • Without conflicts of interest by for-profit entities, and
  • Without conflicts of interest by political entities.

An annotated review of the scientific literature supporting each component of this methodology may be found here.

Methodology

Scope definition, estimate parameters and commentary are collected using a format comfortable to most users, a spreadsheet. A companion spreadsheet is provided with this tool which is interoperable with major spreadsheet rendering software such as Microsoft Office Excel and Google Sheets. The only variable that needs to be entered into this tool is the address or filepath to the companion spreadsheet containing the scope components, estimate parameters, and desired commentary.

companion spreadsheet opened in Google Sheets.

companion spreadsheet opened in Microsoft Excel.

Data is collected in the form of interviews, documentation review, and/or receptor-based discovery scanning in order to define the scope of the assessment. Abstractions of the components within scope are categorized into areas: Assets, Containers / Points of Attack, Agent / Threat Communities, Threat Types, and Threat Effects.

NOTICE: Each column is an independent list. i.e. the contents of rows do not relate to each other.

Scenario Building

Loss scenarios are generated by exhausting all combinations of the components identified as in scope. Implausible scenarios are removed e.g. non-malicious malware. Scenario components are strung together to form the respective scenario.

Parameter Definition

Probability and impact parameters are defined from the integration of data and calibrated subject matter experts for each of the loss scenarios. Predefined distribution parameters and/or hyper-parameters of a loss event are used where they are available and credible.

To take advantage of a person’s natural Bayesian tendencies, calibration questions and responses take the form of frequency formats instead of percentages or fractions.

Frequency formats communicate information to experts in a form that more closely resembles the natural sampling observed in animal foraging and neural networks. What is 1% in standard format would be “10 in 100” in frequency format.

Control Planning

This risk assessment tool facilitates the comparison of different combinations of controls that may reduce the probability, impact, or uncertainty of loss events. The tool calls the first theoretical combination of loss events and controls “Plan-A”. Plan-A represents the absence of any controls in order to establish a baseline or “inherent risk”. Plan-B is the second combination of controls. This is where analysts may list controls that are in place and additional controls that they are considering implementing. Plan C is where the analyst would enter an alternative set or combination of controls which require comparison.

After controls have been entered as column headers under “Controls” the check boxes are used to indicate which loss scenarios that control effects.

e.g. The “Malware scans nightly” control is an applicable control to the Threat Community entries that contain “malicious software”.

Simulation

Monte Carlo Simulation is used to generate a dataset using the parameters provided. The simulations consist of at least 10,000 variations of each loss scenario.

Analysis

The resulting approximating dataset is then analyzed using appropriate statistical methodologies.

Reporting / Communication

Background and scope may be communicated alone or alongside visuals by entering the desired text into the respective sections in the Commentary tab of the spreadsheet.

After analysis has concluded, conclusions and recommendations may also be communicated alone or alongside visuals by entering the desired text into the respective sections of the Commentary tab of the companion spreadsheet.

Col2

Executive Summary

Background


[1] "Director Pat Patson has requested that a risk assessment be performed that illustrates the risk associated with Derp Corp's new NIH data research lab IT."

Scope

Scope Table
Assets at risk
Containers/Points of attack
Threat communities
Threat Types
Effects
Included Excluded Included Excluded Included Excluded Included Excluded Included Excluded
Protected Health Information (PHI) Other PhD’s Laptop DerpCorp AD Systems privileged insiders (DerpCorp & Vendors) deliberately Mechanical confidentiality
Statistician’s Laptop DerpCorp email Systems non-privileged insiders (DerpCorp & Vendors) accidentally Process Failure integrity
Director’s Laptop DerpCorp Networking and FW Systems malicious software Natural availability
R Studio Server DerpCorp Vulnerability Scanner Systems external attackers
NIH Dataset Database Instance DerpCorp Vendor Access
Backup Database Instance DerpCorp Replicated DR Equivalent Systems

Recommendation

[1] "It is recommended that Derp Corp proceed with control Plan B to mitigate risk associated with introducing the new lab to Derp Corp's IT infrastructure."

Next Steps

[1] "Director Patson has requested that Derp Corp's IT personnel provide the analyst with the following information after review of this report. 1. changes to scope as defined in the Scope section of this report. 2. controls from 3. Recommendations section that will be implemented"

Analysis

Projection The net value after factoring in costs, benefits, losses, and mitigation costs over 1 year, 2 year, and 3 years.

Plan A Expected

Year 1 Year 2 Year 3
Benefits $876,748 $914,760 $952,771
Costs $630,417 $1,260,834 $1,891,251
Loss $498,370 $996,741 $1,495,111
Mitigation Costs $0 $0 $0
Prevented Loss $0 $0 $0
Net -$252,039 -$750,410 -$1,248,780

Plan B Expected

Year 1 Year 2 Year 3
Benefits $876,748 $914,760 $952,771
Costs $630,417 $1,260,834 $1,891,251
Loss $350,510 $701,020 $1,051,529
Mitigation Costs $3,022 $3,022 $3,022
Prevented Loss $147,861 $295,721 $443,582
Net $40,660 -$161,989 -$808,220

Plan C Expected

Year 1 Year 2 Year 3
Benefits $876,748 $914,760 $952,771
Costs $630,417 $1,260,834 $1,891,251
Loss $204,367 $408,733 $613,100
Mitigation Costs $60,499 $60,499 $60,499
Prevented Loss $294,004 $588,008 $882,012
Net $275,469 $365,106 -$865,698


[1] "Given the net value after factoring in known initial and recurring costs of this project  as well as the project's known benefits, potential losses due to risks, and control mitigation costs, Derp Corp can expect to realize profit after 2 years of use of this solution provided plan B controls are implemented."

Benefits Parameters provided by experts to approximate benefits of this project

Benefits Table
Benefit UID Benefit Event Benefits Probability Benefits Lower Bound Benefits Most Likely Benefits Upper Bound Benefits Rationale Benefits Recurring_Ben
benefit-1 A grant to the institution 99% $90,000 $1,000,000 $1,000,000 The promised grant amount. FALSE
benefit-2 Infamy from the grant 75% $1,000 $50,000 $100,000 Assumes Upper Bound is cost of one FTE. Not part of original use-case but may be used. TRUE

Costs Parameters provided by experts to approximate the costs of this project.

Costs Table
Known Costs UID Known Cost Event Known Costs Lower Bound Known Costs Most Likely Known Costs Upper Bound Known Costs Rationale Known Costs Recurring Expense
cost-1 Lab Director $100,000 $300,000 $500,000 Going rate range + 25% benefits TRUE
cost-2 Statistician $100,000 $120,000 $300,000 Going rate range + 25% benefits TRUE
cost-3 Subject Matter Expert PhD $100,000 $115,000 $300,000 Going rate range + 25% benefits TRUE
cost-4 Security and compliance review $1,000 $2,000 $8,000 Internal review wage/time to outsourced TRUE
cost-5 IT $500 $30,000 $100,000 Hosting + typical SysAdmin time maintaining TRUE

Scenarios

Scenarios Table
UID Assets at risk Containers/Points of attack Threat communities Threat Types Effects Scenario
Risk-1 Protected Health Information (PHI) PhD’s Laptop privileged insiders (DerpCorp & Vendors) deliberately confidentiality privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through PhD’s Laptop.
Risk-2 Protected Health Information (PHI) Statistician’s Laptop privileged insiders (DerpCorp & Vendors) deliberately confidentiality privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-3 Protected Health Information (PHI) Director’s Laptop privileged insiders (DerpCorp & Vendors) deliberately confidentiality privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through Director’s Laptop.
Risk-4 Protected Health Information (PHI) R Studio Server privileged insiders (DerpCorp & Vendors) deliberately confidentiality privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through R Studio Server.
Risk-5 Protected Health Information (PHI) NIH Dataset Database Instance privileged insiders (DerpCorp & Vendors) deliberately confidentiality privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-6 Protected Health Information (PHI) Backup Database Instance privileged insiders (DerpCorp & Vendors) deliberately confidentiality privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through Backup Database Instance.
Risk-7 Protected Health Information (PHI) PhD’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately confidentiality non-privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through PhD’s Laptop.
Risk-8 Protected Health Information (PHI) Statistician’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately confidentiality non-privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-9 Protected Health Information (PHI) Director’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately confidentiality non-privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through Director’s Laptop.
Risk-10 Protected Health Information (PHI) R Studio Server non-privileged insiders (DerpCorp & Vendors) deliberately confidentiality non-privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through R Studio Server.
Risk-11 Protected Health Information (PHI) NIH Dataset Database Instance non-privileged insiders (DerpCorp & Vendors) deliberately confidentiality non-privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-12 Protected Health Information (PHI) Backup Database Instance non-privileged insiders (DerpCorp & Vendors) deliberately confidentiality non-privileged insiders (DerpCorp & Vendors) deliberately impact the confidentiality of Protected Health Information (PHI) through Backup Database Instance.
Risk-13 Protected Health Information (PHI) PhD’s Laptop malicious software deliberately confidentiality malicious software deliberately impact the confidentiality of Protected Health Information (PHI) through PhD’s Laptop.
Risk-14 Protected Health Information (PHI) Statistician’s Laptop malicious software deliberately confidentiality malicious software deliberately impact the confidentiality of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-15 Protected Health Information (PHI) Director’s Laptop malicious software deliberately confidentiality malicious software deliberately impact the confidentiality of Protected Health Information (PHI) through Director’s Laptop.
Risk-16 Protected Health Information (PHI) R Studio Server malicious software deliberately confidentiality malicious software deliberately impact the confidentiality of Protected Health Information (PHI) through R Studio Server.
Risk-17 Protected Health Information (PHI) NIH Dataset Database Instance malicious software deliberately confidentiality malicious software deliberately impact the confidentiality of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-18 Protected Health Information (PHI) Backup Database Instance malicious software deliberately confidentiality malicious software deliberately impact the confidentiality of Protected Health Information (PHI) through Backup Database Instance.
Risk-19 Protected Health Information (PHI) PhD’s Laptop external attackers deliberately confidentiality external attackers deliberately impact the confidentiality of Protected Health Information (PHI) through PhD’s Laptop.
Risk-20 Protected Health Information (PHI) Statistician’s Laptop external attackers deliberately confidentiality external attackers deliberately impact the confidentiality of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-21 Protected Health Information (PHI) Director’s Laptop external attackers deliberately confidentiality external attackers deliberately impact the confidentiality of Protected Health Information (PHI) through Director’s Laptop.
Risk-22 Protected Health Information (PHI) R Studio Server external attackers deliberately confidentiality external attackers deliberately impact the confidentiality of Protected Health Information (PHI) through R Studio Server.
Risk-23 Protected Health Information (PHI) NIH Dataset Database Instance external attackers deliberately confidentiality external attackers deliberately impact the confidentiality of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-24 Protected Health Information (PHI) Backup Database Instance external attackers deliberately confidentiality external attackers deliberately impact the confidentiality of Protected Health Information (PHI) through Backup Database Instance.
Risk-25 Protected Health Information (PHI) PhD’s Laptop privileged insiders (DerpCorp & Vendors) accidentally confidentiality privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through PhD’s Laptop.
Risk-26 Protected Health Information (PHI) Statistician’s Laptop privileged insiders (DerpCorp & Vendors) accidentally confidentiality privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-27 Protected Health Information (PHI) Director’s Laptop privileged insiders (DerpCorp & Vendors) accidentally confidentiality privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through Director’s Laptop.
Risk-28 Protected Health Information (PHI) R Studio Server privileged insiders (DerpCorp & Vendors) accidentally confidentiality privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through R Studio Server.
Risk-29 Protected Health Information (PHI) NIH Dataset Database Instance privileged insiders (DerpCorp & Vendors) accidentally confidentiality privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-30 Protected Health Information (PHI) Backup Database Instance privileged insiders (DerpCorp & Vendors) accidentally confidentiality privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through Backup Database Instance.
Risk-31 Protected Health Information (PHI) PhD’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally confidentiality non-privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through PhD’s Laptop.
Risk-32 Protected Health Information (PHI) Statistician’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally confidentiality non-privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-33 Protected Health Information (PHI) Director’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally confidentiality non-privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through Director’s Laptop.
Risk-34 Protected Health Information (PHI) R Studio Server non-privileged insiders (DerpCorp & Vendors) accidentally confidentiality non-privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through R Studio Server.
Risk-35 Protected Health Information (PHI) NIH Dataset Database Instance non-privileged insiders (DerpCorp & Vendors) accidentally confidentiality non-privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-36 Protected Health Information (PHI) Backup Database Instance non-privileged insiders (DerpCorp & Vendors) accidentally confidentiality non-privileged insiders (DerpCorp & Vendors) accidentally impact the confidentiality of Protected Health Information (PHI) through Backup Database Instance.
Risk-37 Protected Health Information (PHI) PhD’s Laptop privileged insiders (DerpCorp & Vendors) deliberately integrity privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through PhD’s Laptop.
Risk-38 Protected Health Information (PHI) Statistician’s Laptop privileged insiders (DerpCorp & Vendors) deliberately integrity privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-39 Protected Health Information (PHI) Director’s Laptop privileged insiders (DerpCorp & Vendors) deliberately integrity privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through Director’s Laptop.
Risk-40 Protected Health Information (PHI) R Studio Server privileged insiders (DerpCorp & Vendors) deliberately integrity privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through R Studio Server.
Risk-41 Protected Health Information (PHI) NIH Dataset Database Instance privileged insiders (DerpCorp & Vendors) deliberately integrity privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-42 Protected Health Information (PHI) Backup Database Instance privileged insiders (DerpCorp & Vendors) deliberately integrity privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through Backup Database Instance.
Risk-43 Protected Health Information (PHI) PhD’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately integrity non-privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through PhD’s Laptop.
Risk-44 Protected Health Information (PHI) Statistician’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately integrity non-privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-45 Protected Health Information (PHI) Director’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately integrity non-privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through Director’s Laptop.
Risk-46 Protected Health Information (PHI) R Studio Server non-privileged insiders (DerpCorp & Vendors) deliberately integrity non-privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through R Studio Server.
Risk-47 Protected Health Information (PHI) NIH Dataset Database Instance non-privileged insiders (DerpCorp & Vendors) deliberately integrity non-privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-48 Protected Health Information (PHI) Backup Database Instance non-privileged insiders (DerpCorp & Vendors) deliberately integrity non-privileged insiders (DerpCorp & Vendors) deliberately impact the integrity of Protected Health Information (PHI) through Backup Database Instance.
Risk-49 Protected Health Information (PHI) PhD’s Laptop malicious software deliberately integrity malicious software deliberately impact the integrity of Protected Health Information (PHI) through PhD’s Laptop.
Risk-50 Protected Health Information (PHI) Statistician’s Laptop malicious software deliberately integrity malicious software deliberately impact the integrity of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-51 Protected Health Information (PHI) Director’s Laptop malicious software deliberately integrity malicious software deliberately impact the integrity of Protected Health Information (PHI) through Director’s Laptop.
Risk-52 Protected Health Information (PHI) R Studio Server malicious software deliberately integrity malicious software deliberately impact the integrity of Protected Health Information (PHI) through R Studio Server.
Risk-53 Protected Health Information (PHI) NIH Dataset Database Instance malicious software deliberately integrity malicious software deliberately impact the integrity of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-54 Protected Health Information (PHI) Backup Database Instance malicious software deliberately integrity malicious software deliberately impact the integrity of Protected Health Information (PHI) through Backup Database Instance.
Risk-55 Protected Health Information (PHI) PhD’s Laptop external attackers deliberately integrity external attackers deliberately impact the integrity of Protected Health Information (PHI) through PhD’s Laptop.
Risk-56 Protected Health Information (PHI) Statistician’s Laptop external attackers deliberately integrity external attackers deliberately impact the integrity of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-57 Protected Health Information (PHI) Director’s Laptop external attackers deliberately integrity external attackers deliberately impact the integrity of Protected Health Information (PHI) through Director’s Laptop.
Risk-58 Protected Health Information (PHI) R Studio Server external attackers deliberately integrity external attackers deliberately impact the integrity of Protected Health Information (PHI) through R Studio Server.
Risk-59 Protected Health Information (PHI) NIH Dataset Database Instance external attackers deliberately integrity external attackers deliberately impact the integrity of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-60 Protected Health Information (PHI) Backup Database Instance external attackers deliberately integrity external attackers deliberately impact the integrity of Protected Health Information (PHI) through Backup Database Instance.
Risk-61 Protected Health Information (PHI) PhD’s Laptop privileged insiders (DerpCorp & Vendors) accidentally integrity privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through PhD’s Laptop.
Risk-62 Protected Health Information (PHI) Statistician’s Laptop privileged insiders (DerpCorp & Vendors) accidentally integrity privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-63 Protected Health Information (PHI) Director’s Laptop privileged insiders (DerpCorp & Vendors) accidentally integrity privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through Director’s Laptop.
Risk-64 Protected Health Information (PHI) R Studio Server privileged insiders (DerpCorp & Vendors) accidentally integrity privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through R Studio Server.
Risk-65 Protected Health Information (PHI) NIH Dataset Database Instance privileged insiders (DerpCorp & Vendors) accidentally integrity privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-66 Protected Health Information (PHI) Backup Database Instance privileged insiders (DerpCorp & Vendors) accidentally integrity privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through Backup Database Instance.
Risk-67 Protected Health Information (PHI) PhD’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally integrity non-privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through PhD’s Laptop.
Risk-68 Protected Health Information (PHI) Statistician’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally integrity non-privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-69 Protected Health Information (PHI) Director’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally integrity non-privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through Director’s Laptop.
Risk-70 Protected Health Information (PHI) R Studio Server non-privileged insiders (DerpCorp & Vendors) accidentally integrity non-privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through R Studio Server.
Risk-71 Protected Health Information (PHI) NIH Dataset Database Instance non-privileged insiders (DerpCorp & Vendors) accidentally integrity non-privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-72 Protected Health Information (PHI) Backup Database Instance non-privileged insiders (DerpCorp & Vendors) accidentally integrity non-privileged insiders (DerpCorp & Vendors) accidentally impact the integrity of Protected Health Information (PHI) through Backup Database Instance.
Risk-73 Protected Health Information (PHI) PhD’s Laptop privileged insiders (DerpCorp & Vendors) deliberately availability privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through PhD’s Laptop.
Risk-74 Protected Health Information (PHI) Statistician’s Laptop privileged insiders (DerpCorp & Vendors) deliberately availability privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-75 Protected Health Information (PHI) Director’s Laptop privileged insiders (DerpCorp & Vendors) deliberately availability privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through Director’s Laptop.
Risk-76 Protected Health Information (PHI) R Studio Server privileged insiders (DerpCorp & Vendors) deliberately availability privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through R Studio Server.
Risk-77 Protected Health Information (PHI) NIH Dataset Database Instance privileged insiders (DerpCorp & Vendors) deliberately availability privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-78 Protected Health Information (PHI) Backup Database Instance privileged insiders (DerpCorp & Vendors) deliberately availability privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through Backup Database Instance.
Risk-79 Protected Health Information (PHI) PhD’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately availability non-privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through PhD’s Laptop.
Risk-80 Protected Health Information (PHI) Statistician’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately availability non-privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-81 Protected Health Information (PHI) Director’s Laptop non-privileged insiders (DerpCorp & Vendors) deliberately availability non-privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through Director’s Laptop.
Risk-82 Protected Health Information (PHI) R Studio Server non-privileged insiders (DerpCorp & Vendors) deliberately availability non-privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through R Studio Server.
Risk-83 Protected Health Information (PHI) NIH Dataset Database Instance non-privileged insiders (DerpCorp & Vendors) deliberately availability non-privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-84 Protected Health Information (PHI) Backup Database Instance non-privileged insiders (DerpCorp & Vendors) deliberately availability non-privileged insiders (DerpCorp & Vendors) deliberately impact the availability of Protected Health Information (PHI) through Backup Database Instance.
Risk-85 Protected Health Information (PHI) PhD’s Laptop malicious software deliberately availability malicious software deliberately impact the availability of Protected Health Information (PHI) through PhD’s Laptop.
Risk-86 Protected Health Information (PHI) Statistician’s Laptop malicious software deliberately availability malicious software deliberately impact the availability of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-87 Protected Health Information (PHI) Director’s Laptop malicious software deliberately availability malicious software deliberately impact the availability of Protected Health Information (PHI) through Director’s Laptop.
Risk-88 Protected Health Information (PHI) R Studio Server malicious software deliberately availability malicious software deliberately impact the availability of Protected Health Information (PHI) through R Studio Server.
Risk-89 Protected Health Information (PHI) NIH Dataset Database Instance malicious software deliberately availability malicious software deliberately impact the availability of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-90 Protected Health Information (PHI) Backup Database Instance malicious software deliberately availability malicious software deliberately impact the availability of Protected Health Information (PHI) through Backup Database Instance.
Risk-91 Protected Health Information (PHI) PhD’s Laptop external attackers deliberately availability external attackers deliberately impact the availability of Protected Health Information (PHI) through PhD’s Laptop.
Risk-92 Protected Health Information (PHI) Statistician’s Laptop external attackers deliberately availability external attackers deliberately impact the availability of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-93 Protected Health Information (PHI) Director’s Laptop external attackers deliberately availability external attackers deliberately impact the availability of Protected Health Information (PHI) through Director’s Laptop.
Risk-94 Protected Health Information (PHI) R Studio Server external attackers deliberately availability external attackers deliberately impact the availability of Protected Health Information (PHI) through R Studio Server.
Risk-95 Protected Health Information (PHI) NIH Dataset Database Instance external attackers deliberately availability external attackers deliberately impact the availability of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-96 Protected Health Information (PHI) Backup Database Instance external attackers deliberately availability external attackers deliberately impact the availability of Protected Health Information (PHI) through Backup Database Instance.
Risk-97 Protected Health Information (PHI) PhD’s Laptop privileged insiders (DerpCorp & Vendors) accidentally availability privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through PhD’s Laptop.
Risk-98 Protected Health Information (PHI) Statistician’s Laptop privileged insiders (DerpCorp & Vendors) accidentally availability privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-99 Protected Health Information (PHI) Director’s Laptop privileged insiders (DerpCorp & Vendors) accidentally availability privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through Director’s Laptop.
Risk-100 Protected Health Information (PHI) R Studio Server privileged insiders (DerpCorp & Vendors) accidentally availability privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through R Studio Server.
Risk-101 Protected Health Information (PHI) NIH Dataset Database Instance privileged insiders (DerpCorp & Vendors) accidentally availability privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-102 Protected Health Information (PHI) Backup Database Instance privileged insiders (DerpCorp & Vendors) accidentally availability privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through Backup Database Instance.
Risk-103 Protected Health Information (PHI) PhD’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally availability non-privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through PhD’s Laptop.
Risk-104 Protected Health Information (PHI) Statistician’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally availability non-privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through Statistician’s Laptop.
Risk-105 Protected Health Information (PHI) Director’s Laptop non-privileged insiders (DerpCorp & Vendors) accidentally availability non-privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through Director’s Laptop.
Risk-106 Protected Health Information (PHI) R Studio Server non-privileged insiders (DerpCorp & Vendors) accidentally availability non-privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through R Studio Server.
Risk-107 Protected Health Information (PHI) NIH Dataset Database Instance non-privileged insiders (DerpCorp & Vendors) accidentally availability non-privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through NIH Dataset Database Instance.
Risk-108 Protected Health Information (PHI) Backup Database Instance non-privileged insiders (DerpCorp & Vendors) accidentally availability non-privileged insiders (DerpCorp & Vendors) accidentally impact the availability of Protected Health Information (PHI) through Backup Database Instance.

[1] "Director Patson has requested that Derp Corp's IT personnel provide the analyst with the following information after review of this report. 1. changes to scope as defined in the Scope section of this report. 2. controls from 3. Recommendations section that will be implemented"

ECDF


ECDF…

Density


Density…

Violin


Violin…

Swarm


Swarm…

Box


Box…

Ridge


Ridge